arXiv CSopen access

Inside the Skill Market: From Software Engineering Activities to Reusable Agent Skills

arXiv:2607.09065v1 [cs.SE] 10 Jul 2026

Inside the Skill Market: From Software Engineering Activities to Reusable Agent Skills Jialun Cao∗

Xinru Yan∗

Songqiang Chen

[email protected] The Hong Kong University of Science and Technology Hong Kong, China

[email protected] University of Chinese Academy of Sciences Beijing, China

[email protected] The Hong Kong University of Science and Technology Hong Kong, China

Yaojie Lu

Zhongxin Liu

Shing-Chi Cheung

[email protected] Institute of Software, Chinese Academy of Sciences Beijing, China

liu [email protected] Zhejiang University Hangzhou, China

[email protected] The Hong Kong University of Science and Technology Hong Kong, China

Abstract—Software engineering (abbrev. SE) has continuously evolved through increasingly powerful forms of reuse, from source code and libraries to components and services. Recent advances in AI agents have introduced a potentially new reusable artifact: skills. Emerging agent skill repositories and marketplaces enable developers to package, share, and reuse SE expertise as reusable skills. This trend raises a fundamental question: what SE activities are being encapsulated into reusable skills? Existing studies primarily focus on a broad range of skills acquisition, safety, or benchmarking, while lacking a systematic understanding of SE-specific skills and their coverage across the software development lifecycle. To address this gap, we conduct the first large-scale empirical study of SE skills in public repositories and marketplaces. We collect and analyze a large corpus of SE skills, examining the activities they encapsulate, lifecycle coverage, evolution characteristics, and evaluation mechanisms. Our findings reveal that SE activities are increasingly becoming reusable artifacts via skills and suggest promising research opportunities for skill recommendation and engineering-oriented structuring, as well as the need for mechanisms to encapsulate high-context SE activities into reusable skills. Overall, our study provides the first activity-centric characterization of SE skills and reveals how SE activities are increasingly being transformed into reusable skills. These findings offer new insights into skill reuse, ecosystem development, and the future of agent-centric SE. Index Terms—agent skills, software engineering, software reuse

I. I NTRODUCTION Software engineering (abbrev. SE) has long advanced through increasingly powerful forms of reuse [1]–[4]. Over the past decades, developers have moved from reusing source code fragments to libraries, frameworks, services, and cloud-based infrastructures [3], [4]. Each shift has changed not only how software is constructed, but also what constitutes a reusable software artifact [1], [3]. Reuse has therefore remained a central mechanism for improving productivity, scalability, and knowledge transfer throughout the history of SE. ∗ Both authors contributed equally to this research.

Recent advances in foundation models and AI agents are introducing a potentially new form of reuse [5]. Early work, such as Voyager [6], demonstrated that the agent skills (abbrev. skills), which describe specific functionality of agents, can be accumulated, retrieved, and reused across tasks through persistent skill libraries [7]. Subsequently, agent frameworks such as MetaGPT [8] and ChatDev [9] further showed that SE processes can be structured and decomposed through reusable workflows. More recently, an emerging ecosystem of public skill repositories [10], [11] and marketplaces [12]–[16] has enabled developers to publish, discover, and share skills for a wide range of SE tasks such as code writing [17] and testing [18]. Unlike traditional software artifacts, these skills encapsulate not only executable logic but also prompts, tool invocations, workflows, and domain-specific engineering knowledge [8], [19]–[22]. As a result, SE activities that were traditionally performed manually or implemented repeatedly across projects can now be distributed as reusable skills and directly incorporated into agent-driven development workflows. This emerging trend raises a fundamental question: what SE activities are being encapsulated into reusable skills? While recent studies have investigated how agents acquire skills, retrieve skills, compose skills, and execute SE tasks through agent workflows [6], [8], [19], [23]–[26], little is known about the activities encapsulated within these reusable skills inside the marketplace. There are plenty of studies on skills to either provide broad analyses across diverse domains [27], ranging from literature review and travel planning to domainspecific applications such as healthcare [28] and finance [29], or investigate specific properties such as safety [30], [31] or benchmarking with curated evaluation suites [32]–[35]. While valuable, these studies do not provide a comprehensive understanding of SE-specific skills in emerging skill markets. Consequently, we still lack a principled view of which SE activities are being encapsulated into reusable skills and how

they are represented across the software development lifecycle. This gap limits our ability to reason about skills as SE artifacts: whether they systematically encode development practices such as testing, debugging, verification, or design, and whether current skill ecosystems reflect balanced coverage of the SE lifecycle or are biased toward specific types of activities, such as code generation and vulnerability detection. To address this gap, we present the first large-scale empirical study of SE skills in popular skill marketplaces. We collect and analyze 11,497 SE skills from publicly accessible marketplaces and repositories. Through a comprehensive empirical analysis, we investigate the SE activities these skills represent, their lifecycle coverage, evolution characteristics, and evaluation mechanisms. Our findings reveal a notable shift in the unit of reuse: beyond reusable code and services, SE activities themselves are increasingly becoming reusable artifacts. In addition, our findings suggest promising research opportunities for automated skill recommendation, enhancing skill structures and version mechanisms to facilitate engineering implementation, and exploring mechanisms to build skills for SE activities in high-context lifecycle stages, such as requirement analysis and software design, shedding light on future directions for research on skill design, skill evolution management, activity reuse, and agent-centric software development. In summary, this paper makes the following contributions: • A large-scale empirical study of SE-related skills as reusable artifacts of SE activities: We systematically collect and analyze 11,497 unique SE-related skills from public repositories and marketplaces, and provide the first activitycentric characterization of how SE tasks are encapsulated into reusable skills across the software development lifecycle. • A reuse-oriented taxonomy and coverage analysis of SE activities in skill ecosystems: We introduce a structured mapping from SE activities to reusable skills, revealing which activities are extensively supported by reusable skill abstractions and which remain underrepresented, thereby exposing the uneven reuse landscape across the SE lifecycle. • An analysis of reuse effectiveness through evaluation practices and ecosystem-level skill structures: We investigate how SE-related skills are evaluated and validated in practice and further examine their composition and reuse patterns within skill ecosystems, highlighting the gap between current evaluation mechanisms and the true effectiveness of reuse in real-world SE contexts. II. BACKGROUND AND R ELATED W ORK A. Agent Skill Structure and Usage An agent skill, according to Anthropic’s definition [11], is a modular capability unit that extends an AI agent with reusable functionality. As shown in Figure 1, agent skills are packaged as structured directories with standardized components and a unified execution lifecycle, enabling composability and reuse across heterogeneous agent systems. Conceptually, agent skills provide an abstraction layer between high-level user intents and low-level tools or APIs.

An agent skill consists of five components: (i) Metadata, defined in SKILL.md, specifying the skill name, description, and optional dependencies, versions, tags, and compatibility constraints for discovery and validation; (ii) Instructions, which define the semantic contract of the agent skill, including its purpose, invocation conditions, and operational steps; (iii) Resources, such as templates, schemas, and examples that provide contextual grounding; (iv) optional executable components, including scripts or tool interfaces for external system interaction; and (v) optional supplementary files for documentation and maintenance. The SKILL.md is mandatory, while all other components are optional. The execution of agent skills follows a four-stage lifecycle: discovery, where relevant agent skills are selected based on metadata and task context; interpretation, where instructions and resources are parsed to determine applicability; execution, where the agent follows the skill specification and optionally invokes external components; and completion, where the agent skill contributes to final task resolution. B. Software Reuse Literature Software reuse refers to building software systems using existing artifacts rather than developing from scratch [1]. Early work formalizes reuse as retrieval, adaptation, and integration of reusable assets, while surveys highlight practical limitations such as integration overhead and lack of standard representations [2]. Recent work revisits reuse from an ecosystem and practice-oriented perspective, showing that reuse is often opportunistic and driven by ad hoc composition of existing software modules rather than planned design [36], [37]. This shifts reuse from a static engineering activity to a dynamic system-level phenomenon. Beyond artifact-level reuse, recent research explores processand execution-level reuse. Workflow systems and data pipelines enable reuse of multi-step computational procedures [38], [39], while empirical studies show that process models in practice often contain reusable behavioral structures [39]. In parallel, software product line research advances automated and scalable reuse through variability modeling, extraction, and testing [40], [41]. Program synthesis and API mining further extend reuse to behavioral generation, where reusable patterns are inferred from examples or codebases [42], [43]. More recently, the emergence of AI-native SE has further redefined reuse in the context of generative models. Recent studies [6], [44] suggest that software reuse is shifting toward LLM-based code generation and probabilistic reuse of behavioral patterns, where reuse is no longer deterministic or artifact-bound but increasingly driven by learned procedural capabilities in large-scale models. Still, the study of reusable agent-like capabilities in AI-driven software systems is at an initial stage, which thus motivates our study. C. Surveys on Agent Skills Recent studies have investigated agent skills from multiple perspectives, including ecosystem-level characterization,

High-level View

Structure of an Agent Skill

Runtime Usage

Descriptive Components (in SKILL.MD) 1. Discover & Install User Goal

1. Metadata

2. Instructions

Describes the skill.

Defines what the skill does and how the agent should use it.

In SKILL.md (required) •

Al Agent

Name of, description

--name: skill-name description: Brief description of what this Skill does and when to use it. ---

The agent finds and installs the skill.

In SKILL.md (required) •

When / How to use

• •

Step-by-step guidance Constraints and best practices

•

Examples and few-shot cases

2. Read & Understand The agent reads the metadata, instructions, and resources.

Functional Components (Optional) 4. Executable Components

3. Resources ((Optional)

Skill (Reusable Capability)

(Optional)

Supporting context and knowledge

Code or scripts the agent can invoke to complete actions.

used by the skill. • •

Documents (e.g., .md, .txt, .pdf) Templates (e.g., prompts, configs)

• •

Scripts (e.g., Python, Bash, JS) Tool definitions / function APIs

•

Data files (e.g., schema, rules)

•

Configuration files

•

Any helpful reference materials

•

Entry points and arguments

Tools / APIs / Resources

runs scripts or calls tools.

4. Complete Task The skill helps the agent accomplish the user's goal more effectively and stably.

5. Optional Files E.g., tests/, examples/, README.md, etc.

i

3. Execute The agent follows the instructions and, if needed,

Fig. 1: Structure of an Agent Skill

safety analysis, benchmarking, and domain-specific applicaRQ1. What are the characteristics of SE-related agent tions [27], [30]–[35], [45]–[47]. One line of work focuses skills as reusable units of SE activities? As skills are on broad empirical characterization of agent skills across increasingly positioned as reusable units of execution in heterogeneous domains. These studies analyze large-scale agent-based systems, their fundamental design properties (e.g., agent skill collections spanning general-purpose and domain- granularity and structure) may shed light on preparation specific applications, including literature assistance, travel for effective new skills yet remain poorly understood. We planning, healthcare, and finance [27]–[29]. They primarily thus first examine the structural and functional properties of aim to understand distributional properties, usage patterns, and existing SE-related skills, including their temporal growth, functional coverage of existing agent skill ecosystems. marketplace sources, content length, structural forms, and Another direction studies the safety and security properties versioning characteristics. RQ2. Which SE activities are being captured and reused of agent skills. Existing work identifies vulnerabilities such as prompt injection and privilege escalation through systematic through skills across the software development lifecycle? analysis of real-world skill repositories [30], [31]. Comple- While skills are intended to encapsulate SE capabilities, it mentary efforts construct benchmark suites and evaluation is unclear which parts of the software development lifecycle frameworks to assess robustness and reliability of agent are actually being transformed into reusable artifacts. Thus, skills under adversarial conditions [32]–[34]. In addition, we analyze the mapping between SE lifecycle activities and recent benchmarking-oriented studies design curated evaluation skill artifacts, identifying which types of engineering work are environments to measure skill quality, generalization ability, systematically transformed into reusable skills and how this and compositional performance across tasks [32], [35]. These coverage is distributed. RQ3. How are the SE-related agent skills evaluated and works emphasize controlled assessment settings rather than validated? Existing evaluation practices for skills primarily real-world evolution or longitudinal behavior. Unlike prior studies, which primarily focus on broad cross- rely on task-specific success rates or benchmark performance, domain analyses, safety properties, or benchmark-oriented which may not accurately reflect reuse capability across diverse evaluations of agent skills, our study fills this gap by sys- contexts. As a result, it is unclear whether current evaluation tematically analyzing SE-oriented agent skills in skill markets protocols measure true generalization and transferability of SE to characterize how these capabilities are represented across skills, or merely capture narrow, single-scenario effectiveness. This motivates us to study how skill marketplaces evaluate the software development lifecycle. skills’ practices, assess performance, quality, security, etc. III. S TUDY D ESIGN B. Data Collection A. Research Question Design We developed an automated pipeline to crawl SETo understand how SE activities are transformed into reusable artifacts in emerging skill marketplaces, we structure our study around three research questions that examine skills from intrinsic properties to ecosystem-level reuse structures.

related skills from skill marketplaces (Figure 2), and completed data collection in June 2026. Specifically, we built dedicated crawlers for four representative skill marketplaces: ClawHub [13], SkillHub [14], SkillNet [15], and

Skill Collection

ClawHub

Deduplication

Availability Filter

Relevance Filter 15,895 Candidates

SkillHub

Crawl Skills

Intra-market Deduplication

Cross-market Deduplication

Total collection: 775,790 skills

29,416 Candidates

25,139 Candidates

SkillNet

SkillsMP

Language Normalization

Intersection LLM-based Filter

11,497 Unique SE-related Skills

11,497 Candidates

13,564 Candidates

18,348 Candidates

SE-related Skills Dataset

Drop skills with unavailable bundles

Rule-based Filter

Fig. 2: Collection Pipeline of SE-related Skills 3500

Number of Skills

3000 2500

Skill Updates by Month SkillsMP ClawHub

SkillHub SkillNet 1506

1500 1000 500 0

2566

SkillNet

1661

696 87

4798

SkillsMP

2500

2042

2000

Skill Source Composition by Marketplace

3140

164

275

2025-10 2025-11 2025-12 2026-01 2026-02 2026-03 2026-04 2026-05 2026-06

Fig. 3: Statistics of Skill Updates by Month

1920

SkillHub

524

560

423

1491

ClawHub 0

Overlap with other marketplaces 1500

3000

4500

6000

Number of Skills

Fig. 4: Statistics of Skill Source Marketplaces

SkillsMP [16] following the selection of related work [27]. into a single unified text and perform local rule matching against In terms of their scope of applicable agents, ClawHub [13] is predefined lexicons. The positive lexicon spans the stages the public registry particularly for OpenClaw [48], while Skill- of the SE lifecycle (e.g., requirements, coding, testing, and Hub [14], SkillNet [15] and SkillsMP [16] are more general- deployment). The negative lexicon covers non-SE domains (e.g., purpose, supporting Claude, Codex, Gemini, OpenCode, and business, academia, and healthcare). A skill is judged relevant and retained if its text matches a strong software-engineering other SKILL.md-compliant tools and agents. 1) Skill Collection: We built dedicated crawlers for four phrase, or if the number of positive-lexicon matches reaches a marketplaces and curated a list of 110 SE-related keywords predefined threshold. A skill is discarded if the negative lexicon to serve as query terms for crawling skills. For ClawHub, we matches dominate, or if no positive-lexicon match is found. enumerate skills by submitting query terms to the platform’s This procedure ultimately yields 15,895 relevant skills. We further apply an LLM-based filtering, i.e., for each skill, search API. For each matched slug, we sequentially invoke we use GPT-5.5 [49] to determine whether the skill was related the detail API and the download API, thereby obtaining the to SE based on its name and description. In the prompt, we skill metadata together with the security evaluation results. anchor the judgment on the relevant and non-relevant categories For SkillHub, we enumerate skills by submitting query terms of the SE lifecycle, and instruct GPT-5.5 to conservatively label to the platform’s search API. For each slug returned in the a skill as non-relevant whenever the evidence is weak or the search results, we then invoke the detail API to retrieve the semantics are ambiguous. This step ultimately yields 18,348 skill metadata along with the platform’s evaluation results. relevant skills. By taking the intersection of the relevant skills For SkillNet, we query the platform’s search API, performing identified by the two methods, 13,564 SE-relevant skills remain. paginated retrieval in keyword search mode to collect skill 4) Availability Filter: After excluding 2,067 skills associated metadata and record the platform’s evaluation results. For with deleted (404) repositories, we obtain the final dataset, SkillsMP, we submit query terms to the platform’s search API comprising 11,497 unique SE-related skills. and enumerate skills via a pagination mechanism; we then visit each skill’s detail page to obtain its metadata. In total, we IV. RQ1. C HARACTERISTICS OF SE- RELATED S KILLS collected 775,790 skills across the four marketplaces. 2) Deduplication: We first perform intra-market deduplica- A. Skill Updates Over Time tion. For ClawHub, SkillHub, and SkillsMP, we deduplicate We counted the last update time of all SE-related skills across skills using their slug. For SkillNet, whose skill metadata does four marketplaces, shown in Figure 3. After December 2025, not provide a slug, we instead use the tuple of (skill name, the number of skill updates increased significantly, reaching repository URL) as the deduplication key. After this step, the 2,042 in January 2026. Subsequently, from January to May total number of skills is reduced to 29,416. We perform cross- 2026, it maintained an overall growth trend, indicating that the marketplace deduplication using repository URLs. After this ecosystem of SE skills entered a stage of rapid growth. step, we obtain 25,139 skills. 3) Relevance Filter: We perform language normalization B. Skill Source on each skill’s name and description, converting all nonFigure 4 shows the distribution of SE-related skills across English text into English. We then apply a Rule-based filter. marketplaces. SkillsMP is the largest source, contributing 5,322 Specifically, we concatenate the skill’s name and description skills (46.3%), while only 722 skills (6.3%) overlap across

Number of Skills

Distribution of SKILL.md Token Counts 50% 90%

800

ClawHub Relevant Skills

SkillNet Relevant Skills

SkillHub Relevant Skills

SkillsMP Relevant Skills

95% 98%

600 400 200 0

0

2000

4000

6000 8000 10000 12000 14000 Token Count

Fig. 5: Distribution of SKILL.md Token Counts marketplaces, indicating both the value of multi-marketplace collection and the diversity of existing SE-related skills. C. Skill Length We analyze the length distribution of SE-related skill by tokenizing all SKILL.md files consistently using tiktoken [50], OpenAI’s tokenizer, with the o200k base encoding [30]. The results are shown in Figure 5. Skill lengths exhibit a pronounced long tail distribution, while most skills remain relatively compact. The average skill length is 2,078 tokens. In terms of percentiles, 90% and 95% of skills contain no more than 4,150 and 5,565 tokens, respectively, and 98% of skills are shorter than 7,971 tokens. The statistics indicate that most existing SE-related skills tend not to require long, verbose functionality descriptions. The top 1% of skills exceed 11,185 tokens, with the longest skill reaching 37,499 tokens. Our manual inspection shows that such long skills often integrate multiple auxiliary materials, including reference documentation, code blocks, examples, and external API content. D. Focus Across Skill Marketplaces

Fig. 7: Word Clouds of SE-Relevant Skills in four Marketplaces designing). (4) SkillsMP [16] concentrates on security analysis and configuration automation (e.g., ruby, config, codeql, android, powershell). ⋆ Finding: SE-related skills focus on similar core tasks (e.g., coding and testing) but exhibit marketplace-specific emphases on specific techniques or subjects (e.g., openclaw and git in ClawHub, codeql and android in SkillsMP). Opportunity: The coexistence of shared core tasks and marketplace-specific specializations opens opportunities for automated skill classification, routing, and retrieval, enabling agents to select skills from the most suitable marketplace according to task characteristics. E. Skill Structure

To analyze the structural degree of skills, we conduct We generated word clouds for relevant and irrelevant skills after the two-step filtering process, retaining only words whose statistics at two levels, i.e., descriptive / functional levels, frequency in one group was at least twice that in the other. according to the skill structure visualized in Figure 1. At the descriptive level, we computed the coverage of key Figure 6 shows that relevant skills are dominated by SE-related terms (e.g., testing, security, and code), whereas irrelevant instructional elements in each skill’s SKILL.md file, covering skills mainly focus on business, video, content management, Frontmatter, Usage, Commands, Examples, Workflow, and Verification. As shown in the left subfigure of Figure 8, and research-related tasks. Figure 7 plots word clouds of SE-related skills across Frontmatter reaches 97.8%, indicating that most SE-related four marketplaces: (1) ClawHub [13] concentrates on coding skills provide metadata such as names and descriptions. The automation and version-control workflows (e.g., coding, git, coverage rates of Commands and Verification are 79.3% and sql, software, automated). (2) SkillNet [15] leans toward 73.7%, respectively, suggesting many skills describe executable software development and quality assurance (e.g., c++, azure, operations and result verification methods. Workflow reaches accessibility, traceability, plugin). (3) SkillHub [14] focuses on 60.1%, indicating that more than half of the skills include developer workflows and software design and implementation stepwise procedures. However, Usage and Examples account (e.g., workflows, authentication, implementing, developers, for only 51.3% and 50.1%, respectively, showing that nearly half of the skills still lack clear usage instructions or examples. Relevant Skills Irrelevant Skills At the functional level, we identify the asset forms of each skill, including six categories: Instruction (general guidelines), Documentation (references and playbooks), Script (executable automation), Agent Workflow (agent orchestration processes), Library (reusable packages or APIs), and Application (runnable services or web apps). Specifically, for each downloaded skill bundle, we inspect its directory layout and file artifacts, such Fig. 6: Word Clouds of SE-Relevant / Irrelevant Skills as SKILL.md, documentation files, scripts, workflow-related

Descriptive Component

Functional Component

97.8%

Frontmatter 79.3%

Commands Workflow Usage

51.3%

Library 2.0%

50.1%

Application 1.1%

0

20

40

60

80

Percentage of Skills (%)

100

0

166 136

Automation

Agent Workflow 3.9%

Examples

Security

129

Operations

125 81

Knowledge

20

40

60

80

Percentage of Skills (%)

SkillHub 723

Integrations

10.5%

Script

60.1%

ClawHub Development

18.6%

Documentation

73.7%

Verification

63.8%

Instruction

100

Productivity

47

Agents

45 39

Creative 0

100

200

300

400

500

600

Number of skills

969

2348

38

Aigc

14 0

1360 931 615 394 276

Data & AI

227 70

Databases

1000

1500

2000

1336

Other

500

1500

Tools

DevOps

2000

Number of Skills

2500

Content & Media

60

Blockchain

53 0

200

400

600

800

1000 1200 1400 1600

Number of Skills

Fig. 10: Distribution of Categories Across Marketplaces

400

0

1000

Testing & Security

Documentation

343

Productivity

800

200

500

Development

383

Testing

Security

600

0

SkillsMP

Development

1000

800

87 84 29 26 25 22 18 15 14 13 13 10 4 4

SkillNet

Fig. 8: Distribution of Structural Characteristics

Distribution of Version Counts

700

1979

Development Testing DevOps Backend Security Documentation Frontend Design Data AI/ML Productivity Meta Mobile Integration Cloud

231 107

60 32 16 15 15

8 5 8 3 2 2 2 2 2 12

1 2 3 4 5 6 7 8 9 10 11 12 14 15 16 17 18 >20

Version count

Fig. 9: Distribution of Version Counts

20 versions. Manual inspection of high-version skills shows that their maintenance activities differ in nature. Some release histories correspond to genuine artifact evolution, some reflect documentation-driven hardening, while others are effectively repeated releases without substantive changes.

folders, package configurations, and service or web-application ⋆ Finding: This observation suggests a lack of indicators entry points. When multiple structural signals are present, we and standardized versioning mechanisms for agent users assign the skill to its primary asset form by prioritizing more to assess the maturity and evolution of SE-related skills. engineering-oriented structures over lightweight textual ones. Opportunity: Inspired by prior work [33] which provides The classification results are shown on the right of Figure 8. guidelines for skill evolution for general domains such as Instruction accounts for the largest proportion, reaching 63.8%, execution feedback and trajectory distillation, we highlight indicating that more than half of the SE-related skills are the research opportunities to manage and guide SE-related composed of instructional text without additional engineering skills evolution with SE methods and feedback. assets. Documentation (18.6%) ranks second, suggesting that these skills organize knowledge through documentation assets. V. RQ2. R EUSABLE SE ACTIVITY C OVERED BY S KILLS Only 13.6% of skills contain code-level executable assets, including Script (10.5%), Library (2.0%), and Application A. Marketplace Categories (1.1%). This indicates that most SE-related skills primarily We examine the functionality distribution of SE-related skills support reuse through natural-language instructions and using the category labels provided by each marketplace. Since command descriptions, rather than relying on packaged different marketplaces adopt different category taxonomies, executable interfaces. Meanwhile, complex SE forms are we analyze each marketplace separately. For SkillHub, we less common, including Agent Workflow (3.9%), Library normalize categories according to its official website categories. (2.0%), and Application (1.1%). This suggests that although For SkillsMP, we map fine-grained categories into major current skills show an emerging trend toward engineering, they categories. Since ClawHub updated its category taxonomy still largely remain prompt or documentation-driven. after our initial data collection, we re-crawled the categories of the collected ClawHub skills on June 20, 2026. ⋆ Finding: SE-related skills show a clear emphasis Figure 10 shows the category distribution across the four on the descriptive level, while limited at the functional marketplaces. In ClawHub, Development is the largest category level, especially the engineering-oriented structures (e.g., with 723 skills, followed by Integrations, Automation, Security, scripts, library usage and workflow automation). and Operations. SkillHub shows a stronger concentration: Development accounts for 1,979 skills, substantially exceeding F. Skill Versioning all other categories such as Testing, DevOps, and Backend. We analyzed the number of versions for SE-related skills Similarly, SkillNet is dominated by Development with 2,348 collected from ClawHub (Only ClawHub provides version skills, followed by Testing and Security. In contrast, SkillsMP information). As shown in Figure 9, most skills stopped being exhibits a more balanced distribution, with Tools, Testing updated after their initial release, with 969 skills having only & Security, Development, and DevOps forming the major a single version. This indicates that version count is not a functional groups. These results indicate that skill marketplaces reliable indicator of skill maturity. The maximum number now provide a wide range of reusable SE capabilities, with of versions observed is 72, and 12 skills have more than development as the dominant category. Testing, Security,

Distribution of Skills Across SE Activities

Distribution of Skills Across Lifecycle Stages 2875 (25.0%)

Implementation

2446 (21.3%)

Testing

2198 (19.1%)

Code Review Maintenance & Operations Deployment

1240 (10.8%)

500

1256 1171

Automation Scripting

255 (2.2%)

0

1430

Debugging CI/CD Deployment

363 (3.2%)

Release

1970 1549

Backend Development

609 (5.3%)

Requirement

2343

Security Auditing

1511 (13.1%)

Plan & Design

2877

Code Review Test Automation

1109

Documentation 1,000

1,500 2,000 Number of Skills

2,500

3,000

Fig. 11: Distribution of Skills Across Lifecycle Stages Development, and DevOps also attract more attention than other areas. The distribution suggests that the current marketplace supply is skewed toward certain SE activities rather than all software lifecycle activities. At the same time, we observed differences among marketplace taxonomies. Although the varying native marketplace categories are useful for understanding platform-specific positioning, they may hinder crossmarketplace comparison. This also motivates the construction of a unified task taxonomy in the following analysis in this RQ.

955

Performance Optimization

852

Architecture Design

830

Frontend Development

742

Refactoring Project Planning

675

API & Database Design

647 635

Monitoring & Operations 437

Requirements Analysis

346

Dependency Management

270

LLM Agent Development Other

182

Data Engineering

176

0

500

1000

1500 2000 Number of Skills

2500

3000

Fig. 12: Distribution of Skills Across SE Activities

code-quality judgments. This suggests practitioners leverage abundant existing skills or distill new reusable skills when To analyze the coverage of relevant skills across the SE working on such stages. By contrast, Requirement, Release, lifecycle, we map each skill to a unified lifecycle taxonomy. We and Maintenance & Operations depend more on project-specific define eight lifecycle stages: Requirement, Plan & Design, Im- context, runtime environments, and subjective success criteria, plementation, Code Review, Testing, Release, Deployment, and which increases the difficulty of reusable abstraction. Maintenance & Operations. We use Qwen3.6-35B-A3B [51] ⋆ Finding: SE-related skills are unevenly distributed, with to annotate each skill. For every skill, we construct an input rich support for implementation, testing, and code review instance consisting of its name, description, and SKILL.md stages, but limited support for requirements, planning, content. The prompt provides definitions of the eight lifecycle deployment and maintenance. stages and requires the model to return exactly one label from Opportunity: The uneven lifecycle coverage reveals subthe predefined taxonomy. For skills that span multiple lifecycle stantial opportunities to encapsulate yet-to-be-encapsulated stages, the model is instructed to identify the stage that reflects reusable SE activities into reusable skills. Their lower the skill’s dominant reusable capability. coverage reflects not only a gap in skill quantity in the wild, Figure 11 reports the lifecycle distribution of the SE-related but also a deeper challenge: making high-context lifecycle skills. The results show a clear imbalance across the software work reusable without stripping away the context that lifecycle. Implementation is the largest category, containing makes it meaningful. 2,875 skills (25.0%), followed by Testing with 2,446 skills (21.3%) and Code Review with 2,198 skills (19.1%). Together, these three stages account for 65.4% of all SE-related skills. C. SE Activity Coverage To further understand which SE activities are covered by This indicates that code-centric development and verification activities, with implementation, testing, and code review form existing SE-related skills, we analyze these skills at the level the current dominant lifecycle stages. By contrast, earlier and of fine-grained SE activities. We construct a unified taxonlater lifecycle stages receive substantially less support. Plan & omy containing twenty SE activities, including Code Review, Design contains 1,511 skills (13.1%), while Maintenance & Test Automation, Security Auditing, Backend Development, Operations, Deployment account for 1,240 (10.8%), and 609 Debugging, CI/CD Deployment, Automation Scripting, Doc(5.3%) skills, respectively. Release and Requirement are the umentation, Performance Optimization, Architecture Design, least represented stages, with only 363 (3.2%) and 255 (2.2%) Frontend Development, Refactoring, Project Planning, API & Database Design, Monitoring & Operations, Requirement skills. Overall, the imbalance across lifecycle stages suggests Analysis, Dependency Management, LLM Agent Development, that SE-related skills are easier to form around stages with Data Engineering and Other (e.g., documentation refinement). standardized procedures and relatively objective feedback. We use Qwen3.6-35B-A3B as the annotator. For each skill, we For example, Implementation, Testing, and Code Review are provide the model with the skill name, description, and the typically grounded in concrete artifacts and can be evalu- content of its SKILL.md. For each of the twenty activities, the ated through executable results, static findings, or localized model independently judges whether the skill encapsulates that B. SE Lifecycle Coverage

Lifecycle stages covered by skills Requirement 2.2% Plan & Design 13.1%

Activities covered by skills Requirements Analysis Project Planning Architecture Design API & Database Design Frontend Development

and Security Auditing are almost exclusively associated with their corresponding lifecycle stages. This indicates that reusable skills are generally organized around stage-specific tasks instead of cross-lifecycle capabilities.

Backend Development Implementation 25.0%

Data Engineering LLM Agent Development Automation Scripting Documentation Code Review

Code Review 19.1% Security Auditing

Testing 21.3%

Test Automation Debugging

Release 3.2% Deployment 5.3% Maintenance & Operations 10.8%

⋆ Finding: Most SE activities are strongly associated with a single lifecycle stage rather than crossing multiple stages. Opportunity: Developing reusable skills that span multiple lifecycle stages could enable more seamless end-to-end SE workflows.

Refactoring Performance Optimization Dependency Management CI/CD Deployment Monitoring & Operations Other

Fig. 13: Lifecycle Stage to SE Activity Mapping of Skills activity. The results are shown in Figure 12. Overall, Code Review is the most common activity, with 2,877 skills, followed by Test Automation with 2,343 skills and Security Auditing with 1,970 skills. Together, these three activities account for 35.5% of all task assignments. In contrast, Dependency Management appears in 346 skills, LLM Agent Development in 270 skills, and Data Engineering in 176 skills. These activity-level results echo the previously identified imbalanced skill coverage across lifecycle stages (Section V-B). The highly covered activities (e.g., Code Review, Test Automation, Security Auditing, and Debugging) can often be decomposed into repeatable procedures with relatively clear inputs, outputs, and evaluation signals, which facilitates their encapsulation as reusable skills. Meanwhile, the less covered activities like data engineering, requirements analysis, and project planning are more shaped by domain assumptions, system history, and human preferences. They are harder to encapsulate as reusable skills since they require not only procedural automation, but also the ability to recover and adapt to project-specific context. ⋆ Finding: Current skills show stronger coverage of codefacing and verification-oriented activities, while contextdependent and infrastructure-specific tasks remain sparse. Opportunity: How to encapsulate context-dependent SE activities into reusable skills without sacrificing essential context through abstraction deserves investigation. D. Mapping Between Lifecycle Stages and SE Activities Beyond individual distributions, we further examine the mapping between lifecycle stages and SE activities encapsulated in skills. Figure 13 shows the mapping distribution. We can observe that most SE activities are strongly associated with a single lifecycle stage rather than being evenly distributed across multiple stages. Implementation-related activities, including backend development, frontend development, API and database design, automation scripting, and LLM agent development, overwhelmingly originate from the Implementation stage. Likewise, activities such as Code Review, Test Automation,

In the lens through lifecycle stages, stages do not exhibit a one-to-one correspondence with SE activities. Particularly, Implementation (25.0%) covers the broadest range of SE activities. Besides traditional coding tasks, it also includes Debugging, Documentation, Refactoring, Dependency Management, CI/CD Deployment, Performance Optimization and Project Planning. This suggests that Implementation has become the primary stage where reusable engineering procedures are encapsulated into skills. Similarly, Plan & Design (13.1%) also distributes its skills across a diverse set of activities in practice, including Project Planning, Architecture Design, Requirements Analysis, Documentation, API & Database Design, and even implementationrelated tasks. Rather than corresponding to one dominant activity, it functions as a transitional stage that decomposes highlevel design decisions into multiple more concrete downstream engineering activities. ⋆ Finding: Implementation is the most diversified stage, followed by Plan & Design stage, which serves as a bridge rather than a single activity category. Opportunity: For skills for the stage of Implementation, one may consider decomposing complex implementation workflows into modular and composable reusable skills to facilitate skill reuse and orchestration. For Planing & Design, one may consider explicitly modeling the design rationale and decision propagation, enabling planning knowledge to be reused throughout subsequent stages. On the contrary, Deployment (5.3%) and Maintenance & Operations (10.8%) remain specialized, mainly encapsulating operational activities such as CI/CD Deployment, Monitoring & Operations and Debugging, with relatively limited connections to upstream SE activities. Compared with implementation and testing, these lifecycle stages exhibit a much narrower activity spectrum. ⋆ Finding: Taken together, the mapping between lifecycle stages and SE activities is inherently many-to-many rather than one-to-one. Opportunity: Skills naturally transcend traditional lifecycle boundaries. As agents increasingly orchestrate reusable engineering capabilities, the conventional SE lifecycle may need to be revisited and reorganized around reusable activities.

TABLE I: Evaluation Metrics for Skills Marketplace Metric VirusTotal

ClawHub

SkillHub

Assesses whether the skill contains known malicious artifacts or security risks [52]. SkillSpector Identifies potential vulnerabilities, malicious patterns, and security risks [53]. Purpose & Capability Assesses alignment between the skill’s claimed purpose and actual capability [54]. Evaluates whether instructions remain within the Instruction Scope boundaries of the stated purpose [54]. Install Mechanism Assesses security risks associated with installation content and mechanisms [54]. Credentials Evaluates whether the secrets and environment access requested are proportionate [54]. Persistence & Privi- Assesses whether requested persistence and privilege leges exceed reasonable boundaries [54]. Security Practicality Output Quality Instruction Clarity Maintainability Innovation

Assesses security properties of the skill [14]. Evaluates practical utility of the skill [14]. Assesses output quality produced by the skill [14]. Evaluates clarity of the skill instructions [14]. Assesses maintainability of the skill [14]. Evaluates degree of innovation demonstrated by the skill [14].

Safety

Assesses operational risks and robustness against prompt injection or adversarial manipulation [12]. Evaluates whether critical steps, prerequisites, dependencies, and constraints are sufficiently specified [12]. Assesses whether the skill can be reliably executed in sandboxed agent environments [12]. Quantifies execution overhead in terms of latency, computation, and API usage costs [12]. Evaluates modularity and updateability without disrupting dependencies or compatibility [12].

Completeness SkillNet

Executability Cost Awareness Maintainability

* The explanation is not explicitly provided by the marketplace, so we explained according to the literal meaning.

19.6%

51.8%

17.3%

Concern

Note

OK

Description

Both Benign VirusTotal Only Suspicious SkillSpector Only Suspicious Both Suspicious

11.4%

Fig. 14: ClawHub SE-related Skills Security Analysis Results VI. SE- RELATED S KILL E VALUATION A. Evaluation Metrics Across Marketplaces To understand how SE-related skills are currently validated by marketplaces before reuse, we first compile the evaluation metrics of each marketplace based on its public documentation and the metadata of its skills (Table I). Across marketplaces, evaluation metrics emphasize different aspects of skills. For ClawHub, the evaluation is primarily oriented toward security and boundary control: its metrics combine signature-based scanning, including VirusTotal, an online malware and URL scanning platform commonly used for malware analysis, threat intelligence, and security dataset labeling [55], and SkillSpector, NVIDIA’s open-source AI skill security scanner for detecting malicious patterns, hidden instructions, excessive permissions, prompt injection, and data leakage risks before skill installation [53]. In addition, ClawHub uses five LLMjudged boundary checks: Purpose & Capability, Instruction

15%

Purpose & Capability

29%

57%

24%

Instruction Scope

53%

28%

Install Mechanism Credentials

20%

Persistence & Privilege

17% 0

23% 68%

47%

33%

33% 20

51% 40

60

80

100

Share of ClawHub SE-related Skills (%)

Fig. 15: ClawHub SE-related Skills LLM Evaluation Results Scope, Install Mechanism, Credentials, and Persistence & Privilege [13]. SkillHub adopts a broader general-quality and utilityoriented evaluation scheme, reporting six dimensions: Security, Practicality, Output Quality, Instruction Clarity, Maintainability, and Innovation [14]. SkillNet focuses more on executionoriented readiness, proposing a multi-dimensional evaluation framework that covers Safety, Completeness, Executability, Cost Awareness, and Maintainability [12]. SkillsMP does not provide evaluation metadata. B. Marketplace-Native Evaluation We examine the marketplace-reported evaluation results associated with SE-related skills. The following provides a detailed analysis of the evaluation results for each marketplace: 1) ClawHub1 : Figure 14 compares the results of VirusTotal and SkillSpector on ClawHub SE-related skills. Although the largest group of skills is marked benign by both scanners, a substantial proportion still triggers at least one suspicious signal: 19.6% are marked suspicious by both scanners, 11.4% are flagged only by VirusTotal, and 17.3% only by SkillSpector. Our manual inspection of the one-sided suspicious cases further shows that the two scanners capture different types of risk. VirusTotal-only cases are mainly associated with implementation-level security concerns, such as shell or systemcommand execution, unsanitized inputs, remote script execution, supply-chain-style installation patterns, or access to API tokens and cloud credentials. In contrast, SkillSpector-only cases more often reflect agent-skill-specific boundary risks, including overbroad instruction scope, unclear least-privilege declarations, credential exposure, and persistence or privilege concerns. Figure 15 further reports ClawHub’s five LLM-judged boundary checks, each labeled OK, Note, or Concern. Among the five checks, Install Mechanism shows the most favorable result, with 68% of skills rated as OK, indicating that most ClawHub SE-related skills do not expose obvious installationlevel risks. However, for Instruction Scope, only 23% of skills are rated as OK, while 53% are marked as Note and 24% as Concern. For Credentials, only 33% of skills are rated as OK, and 20% are flagged as Concern. These results indicate that many ClawHub SE-related skills still lack clearly constrained instructions or reasonable access-permission requirements, 1 Following an update to ClawHub’s evaluation metrics, we re-crawled the evaluation fields for ClawHub skills on June 26, 2026.

2

11%

Security

3

18%

4

5

6

7

11%

8

9

100%

10

55%

Maintainability

0.0%

21.2%

78.8%

Cost Awareness

0.2%

19.1%

80.7%

Executability

0.5%

24.7%

74.8%

Completeness

0.0%

44.3%

55.7%

Safety

0.0%

18.1%

81.9%

Poor

Average

Good

80% 15%

Instruction Clarity

79% 50%

Practicality

35%

15%

Output Quality

60%

9%

57%

25%

40% 6%

Maintainability

36%

41%

24%

Innovation 0

20

14%

48%

40

13%

60

80

9%

100

Share of SkillHub SE-related Skills (%)

Fig. 16: SkillHub SE-related Skills Evaluation Results

20%

Share of SkillNet SE-related Skills (%)

1

0%

Evaluation Level

Fig. 17: SkillNet SE-related Skills Evaluation Results which may limit the safety and transferability of skill reuse. Overall, ClawHub’s evaluation reveals security and boundary- rating, while 44.3% received an Average rating. Further analysis control issues, but mainly captures prerequisites for safe reuse of the reason fields shows that Average ratings arise when rather than directly validating cross-context reuse capability. skills describe the intended workflow but leave reuse-critical 2) SkillHub: Figure 16 reports the score distribution details underspecified, including prerequisites and environment of SkillHub SE-related skills across six marketplace-native setup, concrete commands or scripts, input / output formats, evaluation dimensions. Overall, the scores are concentrated in failure handling, and edge case guidance. Overall, SkillNet the upper range, suggesting that SkillHub SE-related skills are mainly evaluates whether a skill is sufficiently specified and generally rated as usable under the platform’s own evaluation executable in its native environment, but cannot validate the criteria. Innovation is the weakest dimension, with 6% of generality and transferability across different SE contexts. skills receiving scores of 5 or below. We manually inspected ⋆ Finding: Current skill marketplaces evaluate SE-related the cons (limitations) associated with skills receiving low skills primarily through marketplace-native metrics that innovation scores and found that their lower innovation is assess safety, quality, and readiness. primarily attributable to placeholder-style content, limited Opportunity: A unified evaluation framework is needed implementation depth and automation, dependence on external to assess reusable SE activities based on the following documentation, generic best-practice-oriented guidance, and properties: triggerability (can the skill be reliably invoked), restricted applicability to specific project contexts. However, attributability (can outcomes be attributed to the skill), this concentration may also reflect limited discriminative power localizability (can failures be localized), and traceability in distinguishing skills with different levels of quality or reuse (can execution be traced), together with their generalizability readiness. Meanwhile, these evaluation metrics are mainly across SE contexts. limited to the static quality of the skill artifact itself, and cannot assess its transferability and generalizability dynamically. 3) SkillNet: SkillNet provides a three-level evaluation (i.e., VII. T HREATS TO VALIDITY Poor, Average, and Good) over five dimensions. Figure 17 shows that Good and Average ratings dominate across all We identify several threats to validity in our study and dimensions, while Poor ratings are rare. In the Safety dimension, describe the mitigation strategies adopted to reduce their impact. 81.9% of skills received a Good rating and 18.1% received an First, Internal validity. A primary threat arises from the Average rating, with no skills rated as Poor. In Cost Awareness, use of LLMs to support the annotation of SE-related skills, 0.2% of skills were rated as Poor. Manual inspection of the per- including identifying the SE activities involved and assigning metric reason fields in metadata indicates that the cases rated as lifecycle phases. Such annotations may introduce subjectivity or Poor are mainly penalized because they prescribe open-ended, inconsistencies due to model reasoning biases. To mitigate this resource-intensive workflows (e.g., repeated test execution, issue, we employ an advanced model (i.e., Qwen3.6-35B-A3B) exhaustive codebase tracing, agent orchestration), without to improve annotation reliability and consistency. In addition, explicit mechanisms to bound runtime, API calls, model usage, we manually validate a representative sample of the annotated or infrastructure cost. In the Executability dimension, 0.5% of data to assess correctness and calibrate for potential annotation skills were rated as Poor. Manual inspection of the per-metric errors. Second, External validity. Our analysis is based on reason fields indicates that poor executability mainly stems skills collected from public skill marketplaces, which may not from broken execution paths (e.g., missing required scripts or fully represent the broader population of agentic skills in the workflow files, dependencies on undefined external tools or wild. This raises concerns about the generalizability of our skills) or incomplete specifications (e.g., missing invocation findings beyond the selected sources. To mitigate this threat, we details, incomplete or erroneous code snippets), which prevent follow established practices in prior studies and collect skills the skills from being run as written. Completeness is the from four widely used and diverse skill marketplaces, aiming to relatively weakest dimension. 55.7% of skills received a Good improve coverage and representativeness of the dataset. While

this does not guarantee full coverage of all existing skills, it provides a broad and practical approximation of the current ecosystem. Third, Construct validity. Another threat relates to the accuracy of evaluation-related information extracted from skill marketplaces. Specifically, the reported evaluation results and metrics associated with skills may be incomplete, inconsistent, or imprecise, potentially affecting the validity of our analysis of reuse evaluation practices. To address this issue, we retain and provide direct references (i.e., source links) for each skill in our dataset, enabling traceability and verification of all extracted evaluation information against the original marketplace records. VIII. C ONCLUSION We conducted a large-scale empirical study of SE-related skills across emerging agent marketplaces to understand how software engineering activities are encapsulated into reusable artifacts. Our findings provide an initial activity-centric view of reusable SE skills, revealing uneven lifecycle coverage and limited reuse-oriented evaluation, and offering insights into the evolution of software engineering reuse in the agent era. R EFERENCES [1] C. W. Krueger, “Software reuse,” ACM Computing Surveys (CSUR), vol. 24, no. 2, pp. 131–183, 1992. [2] W. B. Frakes and K. Kang, “Software reuse research: Status and future,” IEEE transactions on Software Engineering, vol. 31, no. 7, pp. 529–536, 2005. [3] M. P. Papazoglou, “Service-oriented computing: Concepts, characteristics and directions,” in Proceedings of the Fourth International Conference on Web Information Systems Engineering, 2003. WISE 2003. IEEE, 2003, pp. 3–12. [4] A. J. A. Wang and K. Qian, Component-oriented programming. John Wiley & Sons, 2005. [5] Y. Tang, K. Chen, L. Yue, J. Fan, C. Zhou, X. Li, Y. Zhang, M. Zhao, S. Kai, K. Guo et al., “Empowering real-world: A survey on the technology, practice, and evaluation of llm-driven industry agents,” arXiv preprint arXiv:2510.17491, 2025. [6] G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, and A. Anandkumar, “Voyager: An open-ended embodied agent with large language models,” arXiv preprint arXiv:2305.16291, 2023. [7] Y. Jiang, D. Li, H. Deng, B. Ma, X. Wang, Q. Wang, and G. Yu, “Sok: Agentic skills–beyond tool use in llm agents,” arXiv preprint arXiv:2602.20867, 2026. [8] S. Hong, M. Zhuge, J. Chen, X. Zheng, Y. Cheng, J. Wang, C. Zhang, S. Yau, Z. Lin, L. Zhou et al., “Metagpt: Meta programming for a multi-agent collaborative framework,” in International Conference on Learning Representations, vol. 2024, 2024, pp. 23 247–23 275. [9] C. Qian, W. Liu, H. Liu, N. Chen, Y. Dang, J. Li, C. Yang, W. Chen, Y. Su, X. Cong et al., “Chatdev: Communicative agents for software development,” in Proceedings of the 62nd annual meeting of the association for computational linguistics (volume 1: Long papers), 2024, pp. 15 174–15 186. [10] VoltAgent, “Awesome-agent-skills,” 2025. [Online]. Available: https: //github.com/VoltAgent/awesome-agent-skills [11] Anthropics, “Skills,” 2025. [Online]. Available: https://github.com/ anthropics/skills [12] Y. Liang, R. Zhong, H. Xu, C. Jiang, Y. Zhong, R. Fang, J.-C. Gu, S. Deng, Y. Yao, M. Wang et al., “Skillnet: Create, evaluate, and connect ai skills,” arXiv preprint arXiv:2603.04448, 2026. [13] ClawHub, “Clawhub,” 2026. [Online]. Available: https://clawhub.ai [14] SkillHub, “Skillhub,” 2025. [Online]. Available: https://www.skillhub. club/ [15] ZJUNLP, “Skillnet,” 2026. [Online]. Available: http://skillnet.openkg.cn/ [16] SkillsMP, “Skillsmp,” 2025. [Online]. Available: https://skillsmp.com/

[17] D. Huang, J. M. Zhang, M. Luck, Q. Bu, Y. Qing, and H. Cui, “Agentcoder: Multi-agent-based code generation with iterative testing and optimisation,” arXiv preprint arXiv:2312.13010, 2023. [18] M. Harman, J. Ritchey, I. Harper, S. Sengupta, K. Mao, A. Gulati, C. Foster, and H. Robert, “Mutation-guided llm-based test generation at meta,” in Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, 2025, pp. 180–191. [19] J. Yang, C. E. Jimenez, A. Wettig, K. Lieret, S. Yao, K. Narasimhan, and O. Press, “Swe-agent: Agent-computer interfaces enable automated software engineering,” Advances in Neural Information Processing Systems, vol. 37, pp. 50 528–50 652, 2024. [20] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, “React: Synergizing reasoning and acting in language models,” arXiv preprint arXiv:2210.03629, 2022. [21] T. Schick, J. Dwivedi-Yu, R. Dessı̀, R. Raileanu, M. Lomeli, E. Hambro, L. Zettlemoyer, N. Cancedda, and T. Scialom, “Toolformer: Language models can teach themselves to use tools,” Advances in neural information processing systems, vol. 36, pp. 68 539–68 551, 2023. [22] J. Ni, Y. Liu, X. Liu, Y. Sun, M. Zhou, P. Cheng, D. Wang, E. Zhao, X. Jiang, and G. Jiang, “Trace2skill: Distill trajectory-local lessons into transferable agent skills,” arXiv preprint arXiv:2603.25158, 2026. [23] Z. Wang, S. Cai, G. Chen, A. Liu, X. S. Ma, and Y. Liang, “Describe, explain, plan and select: interactive planning with llms enables openworld multi-task agents,” Advances in Neural Information Processing Systems, vol. 36, pp. 34 153–34 189, 2023. [24] Z. Li, D. Guodong, Z. Shi, W. Guo, W. Yao, Y. Zhou, J. Zhang, and J. Li, “Skill weaving: Efficient llm improvement via modular skillpacks,” in Findings of the Association for Computational Linguistics: ACL 2026, 2026, pp. 40 000–40 023. [25] C. Wang, Z. Yu, X. Xie, W. Yao, R. Fang, S. Qiao, K. Cao, G. Zheng, X. Qi, P. Zhang et al., “Skillx: Automatically constructing skill knowledge bases for agents,” arXiv preprint arXiv:2604.04804, 2026. [26] I. Bouzenia and M. Pradel, “Understanding software engineering agents: A study of thought-action-result trajectories,” in 2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 2025, pp. 2846–2857. [27] Y. Zhou, W. Shu, Y. Su, W. Du, Y. Fang, and X. Lin, “A comprehensive survey on agent skills: Taxonomy, techniques, and applications,” arXiv preprint arXiv:2605.07358, 2026. [28] D. Li, Y. He, Y. Hu, Y. Tian, and J. Li, “Can llm agents generate realworld evidence? evaluating observational studies in medical databases,” arXiv preprint arXiv:2603.22767, 2026. [29] Y. Yu, Z. Yao, H. Li, Z. Deng, Y. Jiang, Y. Cao, Z. Chen, J. W. Suchow, Z. Cui, R. Liu et al., “Fincon: A synthesized llm multi-agent system with conceptual verbal reinforcement for enhanced financial decision making,” Advances in Neural Information Processing Systems, vol. 37, pp. 137 010–137 045, 2024. [30] G. Ling, S. Zhong, and R. Huang, “Agent skills: A data-driven analysis of claude skills for extending large language model functionality,” arXiv preprint arXiv:2602.08004, 2026. [31] R. Xu and Y. Yan, “Agent skills for large language models: Architecture, acquisition, security, and the path forward,” arXiv preprint arXiv:2602.12430, 2026. [32] Y. Liu, J. Ji, L. An, T. Jaakkola, Y. Zhang, and S. Chang, “How well do agentic skills work in the wild: Benchmarking llm skill usage in realistic settings,” arXiv preprint arXiv:2604.04323, 2026. [33] K. Ding, Y. Zhou, C. Jin, F. Tong, M. Zhou, and D. N. Metaxas, “Agent skill evaluation and evolution: Frameworks and benchmarks,” arXiv preprint arXiv:2606.11435, 2026. [34] Z. Zeng, Y. Li, R. Xie, W. Ye, and S. Zhang, “Benchmarking and studying the llm-based agent system in end-to-end software development,” arXiv preprint arXiv:2511.04064, 2025. [35] H. Zhang, S. Fan, H. P. Zou, Y. Chen, Z. Wang, J. Zhou, C. Li, W.-C. Huang, Y. Yao, K. Zheng et al., “Coevoskills: Self-evolving agent skills via co-evolutionary verification,” arXiv preprint arXiv:2604.01687, 2026. [36] N. Mäkitalo, A. Taivalsaari, A. Kiviluoto, T. Mikkonen, and R. Capilla, “On opportunistic software reuse: N. mäkitalo et al.” Computing, vol. 102, no. 11, pp. 2385–2408, 2020. [37] R. Capilla, B. Gallina, C. Cetina, and J. Favaro, “Opportunities for software reuse in an uncertain world: From past to emerging trends,” Journal of software: Evolution and process, vol. 31, no. 8, p. e2217, 2019. [38] M. R. Crusoe, S. Abeln, A. Iosup, P. Amstutz, J. Chilton, N. Tijanic, H. Ménager, S. Soiland-Reyes, and C. A. Goble, “Methods included:

Standardizing computational reuse and portability with the common workflow language,” CoRR, vol. abs/2105.07028, 2021. [Online]. Available: https://arxiv.org/abs/2105.07028 [39] M. S. Nikoo, S. Kochanthara, Ö. Babur, and M. van den Brand, “An empirical study of business process models and model clones on github,” Empir. Softw. Eng., vol. 30, no. 2, p. 48, 2025. [Online]. Available: https://doi.org/10.1007/s10664-024-10584-z [40] R. A. F. Moreira, W. K. Assunção, J. Martinez, and E. Figueiredo, “Opensource software product line extraction processes: the argouml-spl and phaser cases,” Empirical Software Engineering, vol. 27, no. 4, p. 85, 2022. [41] P. Jung, S. Lee, and U. Lee, “Automated code-based test case reuse for software product line testing,” Information and Software Technology, vol. 166, p. 107372, 2024. [42] S. Gulwani, O. Polozov, and R. Singh, “Program synthesis,” Found. Trends Program. Lang., vol. 4, no. 1-2, pp. 1–119, 2017. [Online]. Available: https://doi.org/10.1561/2500000010 [43] B. Liu, W. Dong, and Y. Zhang, “Accelerating api-based program synthesis via api usage pattern mining,” IEEE Access, vol. 7, pp. 159 162– 159 176, 2019. [44] T. Mikkonen and A. Taivalsaari, “Software reuse in the generative AI era: From cargo cult towards AI native software engineering,” CoRR, vol. abs/2506.17937, 2025. [Online]. Available: https://doi.org/10.48550/ arXiv.2506.17937 [45] Y. Liu, W. Wang, R. Feng, Y. Zhang, G. Xu, G. Deng, Y. Li, and L. Zhang, “Agent skills in the wild: An empirical study of security vulnerabilities at scale,” arXiv preprint arXiv:2601.10338, 2026. [46] T. Raheem and G. Hossain, “Agentic ai systems: Opportunities, challenges, and trustworthiness,” in 2025 IEEE International Conference on Electro Information Technology (eIT), 2025, pp. 618–624. [47] H. Li, C. Mu, J. Chen, S. Ren, Z. Cui, Y. Zhang, L. Bai, and S. Hu, “Organizing, orchestrating, and benchmarking agent skills at ecosystem scale,” arXiv preprint arXiv:2603.02176, 2026. [48] OpenClaw, “Openclaw: The personal ai assistant framework,” 2026. [Online]. Available: https://openclaw.ai/ [49] OpenAI, “Gpt-5.5 system card,” 2026. [Online]. Available: https: //openai.com/index/gpt-5-5-system-card/ [50] OpenAI, “Tiktoken: A fast bpe tokeniser for use with openai’s models,” 2026. [Online]. Available: https://github.com/openai/tiktoken [51] Qwen Team, “Qwen3.6-35B-A3B: Agentic coding power, now open to all,” April 2026. [Online]. Available: https://qwen.ai/blog?id=qwen3. 6-35b-a3b [52] OpenClaw, “Security audits,” 2026. [Online]. Available: https: //docs.openclaw.ai/clawhub/security-audits [53] NVIDIA, “Skillspector: Security scanner for ai agent skills,” 2026. [Online]. Available: https://github.com/NVIDIA/SkillSpector [54] OpenClaw, “securityprompt.ts,” 2026. [Online]. Available: https: //github.com/openclaw/clawhub/blob/main/convex/lib/securityPrompt.ts [55] VirusTotal, “Virustotal,” 2026. [Online]. Available: https://www.virustotal. com/